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The engine that powers quantum cryptography is the principle that there are no physical means 
for gathering information about the identity of a quantum system's state (when it is known to be 
prepared in one of a set of nonorthogonal states) without disturbing the system in a statistically 
detectable way. This situation is often mistakenly described as a consequence of the "Heisenberg 
uncertainty principle." A more accurate account is that it is a unique feature of quantum phenomena 
that rests ultimately on the Hilbert space structure of the theory along with the fact that time 
evolutions for isolated systems are unitary. In this paper we shall explore several aspects of the 
information/disturbance principle in an attempt to make it firmly quantitative and flesh out its 
significance for quantum theory as a whole. 



> 

o 
in 
o 

\o ■ 
o\ ■ 

^ : 

Ok 
^— > ■ 

G ■ 

s : 



1 Introduction and Model 

Suppose an observer obtains a quantum system secretly 
prepared in one of two nonorthogonal pure quantum 
states. Quantum theory dictates that there is no mea- 
surement he can use to certify which of the two states 
was actually prepared. This is well known |l], and refs]. A 
simple, but less recognized, corollary is that no interaction 
used for performing such an information-gathering mea- 
surement can leave both states unchanged in the process 
p|. If the observer could completely regenerate the un- 
known quantum state after measurement, then — by mak- 
ing further nondisturbing information-gathering measure- 
ments on it he would be able eventually to infer the 
state's identity after all. 

This consistency argument is enough to establish a ten- 
sion between information gain and disturbance in quan- 
tum theory. What it does not capture, however, is the ex- 
tent of the tradeoff between these two quantities. In this 
talk, we shall lay the groundwork for a quantitative study 
that goes beyond the qualitative nature of this tension. 
Namely, we will show how to capture in a formal way the 
idea that, depending upon the particular measurement in- 
teraction, there can be a tradeoff between the disturbance 
of the quantum states and the acquired ability to make 
inferences about their identity. We shall also explore the 
extent to which the very existence of this tradeoff can be 
taken as a fundamental principle of quantum theory — one 
from which unitary time evolution itself can be derived. 

The model we shall base our considerations on is most 
easily described in terms borrowed from quantum cryp- 
tography, from whence it takes its origin. Alice randomly 



prepares a quantum system to be in cither a state po or 
a state p\. These states will most generally be described 
by N x A*" density operators on an A-dimcnsional Hilbert 
space, N arbitrary; there is no restriction that they be 
pure states, orthogonal, or commuting for that matter. 
After the preparation, the quantum system is passed into 
a "black box" where it may be probed by an eavesdropper 
Eve in any way allowed by the laws of quantum mechan- 
ics. That is to say, Eve may first allow the system to 
interact with an auxiliary system, or ancilla, and then 
perform quantum mechanical measurements on the an- 
cilla itself H . The outcome of such a measurement may 
provide Eve with some information about the quantum 
state and may even provide her a basis on which to make 
an inference as to the state's identity. Upon this man- 
handling by Eve, the original quantum system is passed 
out of the "black box" and into the possession of a third 
person Bob. 

A crucial aspect of this model is that even if Bob knows 
the state actually prepared by Alice and, furthermore, the 
manner in which Eve operates, because the system will 
have become entangled with Eve's ancilla, he will still 
have to resort to a new description of the quantum sys- 
tem after it emerges from the "black box" — say by some 
p' Q or p[. This is where the detail of our work begins. 
Eve now has the potential to gather information about 
the quantum state; meanwhile that state is no longer a 
valid description of Bob's system because it has become 
entangled with Eve's ancilla. 

The ingredients required to formally pose an informa- 
tion/disturbance tradeoff principle follow from the details 
of the model. We shall need: 
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A) a concise account of all ancillas and interactions that 
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Eve may use to obtain evidence about the identity of 
the state 

B) a convenient description of the most general kind of 
quantum measurement she may then perform on her 
ancilla 

C) a measure of the information or inference power pro- 
vided by any given measurement, 

D) a good notion by which to measure the distinguisha- 
bility of mixed quantum states and a measure of dis- 
turbance based on it, and finally 

E) a "figure of merit" by which to compare the distur- 
bance with the inference. 

In the next section, we shall carry this program out in 
some detail for two pure quantum states to give a flavor 
of how it should go in the general case. However, before 
pursuing this, perhaps we should say a word or two about 
the significance of these ideas. It is often said that it 
is the Heisenberg uncertainty relations that dictate that 
quantum measurements necessarily disturb the measured 
system. To the extent that this statement can be given a 
precise meaning, it is rather beside the point in this con- 
text. The Heisenberg relations concern the inability to 
get hold of two classical observables simultaneously, such 
as spin in the x direction and spin in the y direction. 
Thus it concerns our inability to ascribe classical states 
of motion to quantum mechanical systems. This, in and 
of itself, generally has very little to do with the limits of 
what can happen to a quantum state when information is 
gathered about its identity. The theme of this approach 
differs from that used in formulating the Heisenberg rela- 
tions in that it makes no reference to conjugate or comple- 
mentary variables. The only elements entering these con- 
siderations are related to the quantum states themselves. 
In this way one can get at a notion of state disturbance 
that is purely quantum mechanical, making no reference 
to the sort of semi-classical considerations that drove the 
early conceptual work on the theory's interpretation. 

What does it really mean to say that the states are dis- 
turbed in and of themselves without reference to classical 
variables? It means quite literally that Alice faces a loss 
of predictability about the outcomes of Bob's measure- 
ments whenever an information gathering eavesdropper 
intervenes. Take as an example the case where po and pi 
are nonorthogonal pure states. Then, for each of these, 
there exists one nontrivial observable for which Alice can 
predict the outcome with complete certainty — namely the 
projectors parallel to po and p\, respectively. However, 
after Alice's quantum states pass into the "black box" 
occupied by Eve, neither Alice nor Bob will any longer 
be able to predict with complete certainty the outcomes 
of both these measurements. This is the real content of 
these ideas. 



2 Pure States 

Let us now carry out the last example in greater detail. 
Consider the case where Alice prepares, with equal prob- 
ability, one of the following nonorthogonal states on a 
two-dimensional Hilbert space Ha- 

|0) = cosa|a ) + sinala!) (1) 
|1) = sina|a ) + cosa|ai) , (2) 

where |oo) and |ai) form an orthonormal basis on the 
space. A good measure of the nonorthogonality of these 
states is given by their inner product: 

S = (0|1) = sin 2a . (3) 

Eve, in an attempt to gather information about the iden- 
tity of the state Alice prepared, will interact Alice's sys- 
tem with an ancilla described by the states in a Hilbert 
space He- This interaction takes its formal description as 
a unitary operator U on Ha® He- Supposing the ancilla 
starts off in some standard pure state 1^), we can describe 
the outcome of this interaction as follows: 

l 

\ sM |*a*) = j2Vk\k)\k) , (4) 

n=0 

s = 0, 1, and where l^* 15 ) is written in Schmidt polar 
form [Q for orthonormal bases (parameterized by Alice's 
state s) and \E%) on Ha and He respectively. The 
bases and the constants A* will of course depend on the 
particular unitary operation U used. The state of the 
system finally left in Eve's possession is given by tracing 
Ha out of the picture, i.e., the mixed state 

p e s = tr A (i*rx*ri) 

= K\E%)(E* \ + Xt\El)(E(\ . (5) 
Similarly the states passed on to Bob are 

Ps = tr E (i*r)(*ri) 

= \ s \Ati(A%\ + Xi\A{)(Al\ . (6) 

Eq. (|^) tells us immediately that we never need consider 
ancillas for Eve with Hilbert space dimension greater than 
four ||. For, at most all four of the \E^} can be linearly 
independent vectors. 

With this much as set up, how can we best gauge the 
tradeoff between the disturbance Eve has caused in Alice's 
system and the information or inference power she has 
gained? There are several ways to go about this |j| . For 
specificity here, we assume that disturbance is gauged by 
the average probability that Bob will detect a discrepancy 
if Alice announces the state she sent and he checks on the 
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identity of that state. That is to say, we will define the 
disturbance to be 



d(u) = i - Imm 



5<iK|i> 



(7) 



(The operator U is listed in this expression to remind us 
that D is explicitly a function of whatever unitary opera- 
tion Eve uses to entangle her ancilla with Alice's system.) 

For a measure of inference power gained by Eve, we take 
the best possible average probability that she will make an 
error in guessing of the state's identity after performing 
a measurement on the ancilla.^] In order to get at this 
expression, one needs the formalism of Positive Operator 
Valued Measures (l], ||. However, we record it here for 
reference^] 



Pe(U) = - - 



tr 



Pi - Po 



(8) 



where | • | signifies an operator diagonal in the same basis 
as its argument, but with eigenvalues that are the abso- 
lute values of those of the argument. It is the tradeoff 
between D(U) and P e (U) that we should like to explore 
as a function of U. 

Rather than considering the full-blown problem of eval- 
uating the tradeoff between these quantities for four- 
dimensional He, here we stave off some of the mathe- 
matical difficulties encountered there by restricting our- 
selves to three-dimensional He- This allows for an easier 
path to the essential physics. (Besides, in the problem of 
Ref. [| it was found by numerical simulation that two- 
dimensional He always sufficed for the optimal tradeoff.) 

Let us consider the set of unitary operators that take 
\s)\tp) to real superpositions of the basis states \a m )\e0), 
m = 0, 1 and (3 = x,y, z, on Ha <£> He- Also, let us make 
the reasonable assumption of only considering Us that 
obtain the same symmetry on the ancilla's relative states 
as that of Alice's states in the sense that: if 
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\R„ 



(9) 



then all inner products (Rm'n'\Rmn) remain invariant un- 
der an interchange of <-> 1 in the indices^] 

It will be shown in the full paper to be submitted to 
these proceedings that the set of all such Us can be pa- 
rameterized by three real numbers A, </>, and 9. Moreover, 

1 Another measure of Eve's performance is given by the best pos- 
sible Shannon information that can be gained about the identity of 
/3* ji| . The present choice of the error probability in modeling Eve's 
gains has been made because of its relative tractability — the prob- 
lem can be handled start to finish without numerical simulations — 
and its consequent illustrative value. 

2 This convenient form of expression was worked out in collabo- 
ration with Jeroen van de Graaf. 

3 A more complete explanation of the origin of these assumptions 
can be found in Ref. fef. 



D(U) and P e (U) work out explicitly to be 
D(U) = cos 2 A (sin 2 9 — -5 cos 20 sin 20 



7}S 2 (l - sin 20) cos20J (10) 



and 



where 



Pe(U) = \~ \^¥{G(^), 



(11) 
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G(U) = cos 4 Acos 2 20 + - sin 2 2A(l - sin 2^) cos 2 6> . 

2 (12) 
Ideally, what one would like to do with these quantities 
is form from them a curve of the smallest possible D as 
a function of P e . However that leads to a pretty hefty 
constrained-variation problem. Suffice it for the present 
to consider a much simpler problem where the "figure 
of merit" is the ratio G/D — the larger this quantity, the 
more effective the given U will have been at leading to a 
good inference while minimizing the disturbance. (More 
details of the full constrained variation problem will ap- 
pear in the full paper.) 

For fixed 9 and 4> with sin 20 > 0, G/D is maximized 
when A = — that is to say, a two-dimensional ancilla 
again suffices. Then it is straightforward to calculate the 
best possible D for a fixed P e . It is given by 



D = I _ h S 2 G 
2 2 



1 - s 2 1 - VT~G 



1/2 



where 



G 



1 / ^ 
1 - 2P P 



l-S 2 



(13) 
(14) 



Notice that D — ► as P e — ► 1/2, just as one would expect. 
D reaches its maximum value when P e reaches its mini- 
mal value. Eqs. fl3| ) and (|lj) completely define the best 
possible inference/disturbance tradeoff in this context. 

3 Mixed States 

The deepest understanding of what the information/dis- 
turbance principle has to say about quantum theory as a 
whole will necessarily come from the mixed-state analog 
of these considerations. For only then can a direct com- 
parison be made to classical probability distributions on 
phase space — the object of study in classical information 
theory 0. Unfortunately, in moving to the mixed state 
version of this principle, the mathematical difficulties be- 
come even more acute. Some progress in the face of these 
troubles will be reported in the full paper. 

However, in the mean time, there is one restricted result 
about information gain vs. disturbance for mixed states 
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that brings out an interesting mystery. This result is 
known as the "no- broadcasting theorem" B . 

Suppose a quantum system, secretly prepared in one 
state from the set A = {po, Pi}, is dropped into a "black 
box" whose purpose is to broadcast or replicate that quan- 
tum state onto two separate quantum systems. That is 
to say, a state identical to the original should appear in 
each system when it is considered without regard to the 
other (though there may be correlation or quantum en- 
tanglement between the systems). Can such a black box 
be built? If so, then that will certainly provide a way to 
gain information about the mixed state without causing 
a detectable disturbance in the system. 

The "no-cloning theorem" || [To) insures that the an- 
swer to this question is no when the states in A are pure 
and nonorthogonal; for the only way to have each of the 
broadcast systems described separately by a pure state 
\ip) is for their joint state to be (g> \ip). When the 
states are mixed, however, things are not so clear. There 
are many ways each broadcast system can be described 
by p without the joint state being p £g> p, the mixed state 
analog of cloning. The systems may also be entangled or 
correlated in such a way as to give the correct marginal 
density operators. 

For instance, consider the limiting case in which po and 
pi commute and so may be thought of as probability dis- 
tributions po{b) and pi(b) for the eigenvectors in a com- 
mon diagonalizing basis. In this case, one easily sees that 
the states can be broadcast; the broadcasting device need 
merely perform a measurement of the eigenbasis and pre- 
pare two systems, each in the state corresponding to the 
outcome it finds. The resulting joint state is not of the 
form p (£> p but still reproduces the correct marginal prob- 
ability distributions and thus, in this case, the correct 
marginal density operators. 

It turns out that the case just described is indeed a 
rather special one, for two states po and p\ can be broad- 
cast if and only if they commute [^J. That is, if and only 
if they can be simultaneously thought of as classical prob- 
ability distributions for some underlying reality. This is 
the content of the no-broadcasting theorem. 

The enticing mystery that arises from the no-broad- 
casting theorem is the following. A detailed study of 
Eqs. ( |l3| ) and (|l4|) and their analogs in Ref. || reveals 
that information can be gained about the identity of two 
pure quantum states without disturbance if and only if 
they are orthogonal. (Also see Ref. ||.) It follows that 
there can be information gain without disturbance if and 
only if the two pure states can be cloned. 

One might expect the same sort of behavior to hold for 
mixed states: that information can be gained without dis- 
turbance if and only if the two states can be broadcast. 
This thought, however, is misguided.^] Life becomes in- 

4 I thank Ben Schumacher and Michael Nielsen for discussion on 



terestingly more complex when it comes to mixed states. 

A simple example to consider is that of two density 
operators on a four-dimensional Hilbert space. In ma- 
trix representation, suppose they do not commute on a 
2x2 block but do on the orthogonal complement to it. 
The states will thus have two common eigenvectors. Sup- 
pose the eigenvalues associated with the common eigen- 
vectors are all distinct. Then it follows immediately that 
there are information gathering measurements that will 
cause no disturbance to these states — it consists of check- 
ing whether the system is in the 2x2 block or either of 
the other two eigenvectors. This measurement can be per- 
formed as a quantum nondemolition measurement. Since 
the eigenvalues are all distinct, there are distinct proba- 
bilities for all these outcomes and thus information to be 
gained. However, because these two states are noncom- 
muting overall, they cannot be broadcast. 

An interesting open question is the necessary and suffi- 
cient mathematical criteria required of two density oper- 
ators to insure that information gathering measurements 
necessarily disturb the quantum states. A conjecture is 
that this will be the case when they commute on no non- 
trivial subspace. 



4 Foundations 

Finally we briefly sketch the statement of a theorem that 
indicates that the information/disturbance tradeoff prin- 
ciple may be a fundamental aspect of quantum theory.^] 
Details of its proof will be given in the full conference 
paper. 

Let us go back to the Hilbert space Ha ®He an d sup- 
pose we consider all of quantum mechanics intact and 
beyond question except for the general group of time evo- 
lutions that this space may be submitted. We shall sup- 
pose that this group T consists of all maps (continuous in 
time) that are bijections oIHa®He onto itself, and that 
it contains at least all the unitary operations. A priori, 
however, we may not wish to tie down the set of evolu- 
tions any further than this — it might contain other linear 
maps, nonlinear maps, maps discontinuous with respect 
to the topology of the vector space, or what have you. 

As it stands, not much can be said about the group 
T. So let us now consider what would be required of 
a mapping <I> € T if it were to be capable of breaking 
the principles espoused in this paper. A mapping $ is 
said to allow illegal eavesdropping (i.e., information gain 
without disturbance) if there are two nonorthogonal states 
\s), s — 0, 1, in Ha and a standard state \a) in He such 

these points. 

5 I thank Michel Boyer, Gilles Brassard, Nicolas Gisin, Asher 
Peres, and Bill Wootters for listening to me patiently on these 
points. 
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that 



|s)|ct s 



(15) 



s = 0, 1, for which < |(<to|<ti)| < 1. (All vectors in this 
description are assumed normalized.) If such a map ex- 
isted, then — since we are assuming all the other principles 
of quantum mechanics are still intact — a measurement on 
TLe alone will certainly reveal information about the state 
\s) without disturbing it. 

Suppose now, we find the existence of such maps too 
unbearable, and we take it as a principle that such time 
evolutions cannot exist. The question is, can we still be 
left with time evolutions that are more general than those 
provided by the unitary group? For instance, one can 
easily imagine maps on Ha ®He that are perfectly well 
behaved on product states, doing just what we expect, 
even though their behavior goes completely awry on the 
set of entangled states. 

The answer to the question is "no." If there is a map 
in T that allows the increase or decrease of the modulus 
of any inner product of two states in Ha ® He, then 
we can construct another map that will use that effect for 
illegal eavesdropping. This will be shown in the full paper. 
Thus, if the information/disturbance tradeoff principle is 
to be upheld, T can only contain inner-product modulus 
preserving maps. And this, it turns out, is the premise 
for Wigner's famous theorem jjj stating that, allowing 
the possible redefinition of phase, all such maps must be 
unitary or anti-unitary. If the maps are to be continuous 
in time, then they must be unitary. 

This simple point demonstrates that there are things 
to be learned about quantum theory itself by observing 
how it can be used for communication and computation. 
The result is not completely satisfactory in that we had 
to require that T contain at least the unitary maps before 
we could make any progress. Nevertheless, it does provide 
food for thought. 
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